Maycon Santos c051ca8f87 [client,proxy,management,signal,relay] Distrust compromised eMudhra CA keys (#8326) ...

* [client,proxy,management,signal,relay] Distrust compromised eMudhra CA keys

Eight eMudhra intermediate CA private keys were compromised and browsers
blocked them on 2026-10-17. Our binaries were built with go1.26.7, which
accepts chains through those intermediates whenever the trust store still
holds emSign ECC Root CA - G3. go1.26.10 rejects them in crypto/x509 on
every platform, regardless of the trust store.

The UBI base still ships the root and Red Hat has no fixed package yet, so
the UBI images blocklist it with p11-kit. The ingest image, the UI server
image and the pinned Chainguard digests also carried the root and move to
bases that no longer do.

* [client,proxy,management,signal,relay] Use the fixed UBI base instead of a blocklist

Red Hat shipped ca-certificates 2026.2.92_v9.0.319-90.3 on 2026-10-22,
which drops emSign ECC Root CA - G3 and AAA Certificate Services. The
current ubi9-minimal image carries it, so pin that digest and remove the
p11-kit blocklist step.

* [misc] Pin upload-server images by digest only and restore go.mod comment

2026-10-24 01:07:20 +02:00

..

privileged

[client,proxy,management,signal,relay] Distrust compromised eMudhra CA keys (#8326)

2026-10-24 01:07:20 +02:00